Debian Bug report logs - #309504
CAN-2005-1519: DNS Spoofing

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Martin Pitt <mpitt@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Cc: team@security.debian.org

Subject: CAN-2005-1519: DNS Spoofing

Date: Tue, 17 May 2005 19:06:32 +0200

[Message part 1 (text/plain, inline)]

Package: squid
Version: 2.5.9-8
Severity: grave
Tags: security patch
Justification: user security hole

Hi!

CAN-2005-1519 is not yet fixed in Debian, see

  http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE9-dns_query

for details. I prepared an Ubuntu Breezy update which applies to
Sid/Sarge as well:

  http://patches.ubuntu.com/patches/squid.CAN-2005-1519.diff

Martin

-- System Information:
Debian Release: 3.1
  APT prefers testing
  APT policy: (500, 'testing')
Architecture: i386 (i686)
Kernel: Linux 2.6.11.9
Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8)

Versions of packages squid depends on:
ii  adduser                     3.63         Add and remove users and groups
ii  coreutils                   5.2.1-2      The GNU core utilities
ii  debconf                     1.4.30.13    Debian configuration management sy
ii  libc6                       2.3.2.ds1-21 GNU C Library: Shared libraries an
ii  libldap2                    2.1.30-6     OpenLDAP libraries
ii  libpam0g                    0.76-22      Pluggable Authentication Modules l
ii  logrotate                   3.7-2        Log rotation utility
ii  netbase                     4.21         Basic TCP/IP networking system
pn  squid-common                             Not found.

-- 
Martin Pitt              http://www.piware.de
Ubuntu Developer   http://www.ubuntulinux.org
Debian Developer        http://www.debian.org

[signature.asc (application/pgp-signature, inline)]

Message #12 received at 309504@bugs.debian.org (full text, mbox, reply):

From: Luigi Gangitano <luigi@debian.org>

To: 309504@bugs.debian.org, Martin Pitt <mpitt@debian.org>

Cc: team@security.debian.org

Subject: Re: Bug#309504: CAN-2005-1519: DNS Spoofing

Date: Wed, 18 May 2005 00:41:12 +0200

[Message part 1 (text/plain, inline)]

> CAN-2005-1519 is not yet fixed in Debian, see
> 
>   http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE9-dns_query
> 
> for details. I prepared an Ubuntu Breezy update which applies to
> Sid/Sarge as well:
> 
>   http://patches.ubuntu.com/patches/squid.CAN-2005-1519.diff

CAN-2005-1519 has been fixed in squid-2.5.9-9, which is already in
sarge. There's no reference in the changelog since there was no CAN id
available at upload time.

A fix for woody is in the works.

Regards,

-- 
 Luigi Gangitano -- <luigi@debian.org> -- <gangitano@lugroma3.org>
 GPG: 1024D/924C0C26: 12F8 9C03 89D3 DB4A 9972  C24A F19B A618 924C 0C26

[signature.asc (application/pgp-signature, inline)]

Send a report that this bug log contains spam.